What the vulnerability does
01Description
The Bit File Manager – 100% Free & Open Source File Manager and Code Editor for WordPress plugin for WordPress is vulnerable to Limited JavaScript File Upload in all versions up to, and including, 6.5.7. This is due to a lack of proper checks on allowed file types. This makes it possible for authenticated attackers, with Subscriber-level access and above, and granted permissions by an administrator, to upload .css and .js files, which could lead to Stored Cross-Site Scripting.
Explanation of Vulnerability in Simple Terms
02Summary
Bitpress File Manager versions up to 6.5.7 allow authenticated users to upload files without proper validation. An attacker with low-level access can upload malicious files to the server, potentially including executable code. This could lead to unauthorized access to sensitive data or modification of site content.
What an attacker can do
03Attacker Capabilities
Upload malicious files to the server, potentially including executable code or scripts.
Potential impact on your site
04Site Impact
Unauthorized file uploads could expose sensitive data, allow code execution, or compromise site integrity.
Conditions required to exploit
05Prerequisites
Attacker must have low-level authenticated access to the File Manager component.
Key dates
06Disclosure timeline
October 5, 2024
CVE published
April 8, 2026
Record updated
